JP2010541441A - Computer-implemented method, data processing system, and computer program (router detection) for detecting unauthorized routers in a distributed network - Google Patents

Abstract

A computer-implemented method, data processing system, and computer program for discovering unauthorized routers in a network.
The processes of the illustrative embodiments first obtain the physical address of the suspect router or destination device. Create a data packet that includes at least the destination media access control field, the destination internet protocol field, and the active time field, where the destination media access control field contains the physical address of the destination device and the destination internet protocol field is Contains a fake Internet Protocol address and the activity time field contains a value indicating that the data packet has exceeded the time limit. Use the physical address in the destination media access control field to send the data packet to the destination device. If an overtime message is received from the destination device, it is determined that the destination device is available for routing.
[Selection] Figure 2

Description

  The present invention relates generally to an improved data processing system, and more particularly to a computer-implemented method, data processing system, and computer program product for discovering unauthorized routers in a network.

  Distributed network data processing systems are becoming increasingly popular in businesses and homes. Typically, a network data processing system includes a network having a medium that is used to provide a communication link between various devices and computers connected in the network. This medium includes wires that provide communication links with other devices, such as routers, that route data between various devices on the network. One protocol used to transmit data within a network is the Transmission Control Protocol / Internet Protocol (TCP / IP). This protocol is used on the Internet and can also be implemented in other networks such as an intranet, a local area network (LAN), or a wide area network (WAN). TCP provides a transport function to ensure that the total number of bytes transmitted is received correctly on the other side. IP is used to accept a packet from TCP and adds a header to the data link layer protocol to deliver the packet. IP addresses are used by all clients and servers in the network to send data between various systems.

  A router is a device that determines an appropriate path for moving data between different networks (ie, individual logical subnets). The router forwards the data packet along this path to the next device. The router can create or maintain a table of available routes and their conditions and use this information to determine the best route for a given packet.

  In the security world, unauthorized routers in an organization's network are known as rogue routers. Such unauthorized routers are not monitored, nor are machines on the router's subnet. Because there are some security concerns associated with such routers, organizations do not want unauthorized routers to operate on their networks. Even if the user is not malicious, the client device in the network can become a rogue router. For example, if a user connects a laptop computer to a client device and uses a modem to access e-mail over the Internet, the modem becomes an unauthorized router. If the operating system on the user's laptop includes a router function and that function is enabled, the laptop can also act as a router. This scenario creates a security problem because the user's laptop includes a weaker firewall than the authorized router. As a result, it is desirable that the network security administrator can detect unauthorized routers and stop their operation.

  When a packet is sent from one computer to another, the packet traverses zero or more routers. The series of routers that a packet traverses is called its route or path. One router traversal is called a hop. With current technology, the traceroute utility can detect routers in a network by recording the route through the distributed network between the source machine and the specified destination machine. . If the destination machine is active and the monitoring tool in the source machine can ping the destination machine's IP address, it can detect the router (s) between the source machine and the destination machine Is possible. The traceroute command operates by sending a series of packets (using Internet Control Message Protocol or ICMP) to the target destination machine. The first packet is constructed with a limited time-to-live (TTL) value designed to be exceeded by the first router receiving the packet for the first hop. For example, the TTL value in the first packet has a value of 1. When the first router encounters a packet with a TTL value of 1, the first router is obliged to send an ICMP time exceeded message (type 11) back to the sending source machine. The sending source machine also sends other packets containing an activity time (TTL) value of 2 for the second hop, and then others including an activity time (TTL) value of 3 for the third hop. Are transmitted in the same manner. As a result, each router in the path will respond with a type 11 packet between the sending source machine and the destination machine. When the final destination machine responds to the packet, the process stops.

  You can use the traceroute utility to find routers in the network, but the problem with the traceroute utility is if the routed subnet is unknown or the machines on the router subnet are silent If the machine is down, the network administrator cannot find out if the machine is routing. Therefore, current technology utilities such as traceroute only allow the source machine to discover if the machine is a router if it knows the IP address of the subnet or the IP address of the machine in the subnet. It is.

  The illustrative embodiments provide a computer-implemented method, data processing system, and computer program for discovering unauthorized routers in a network. The processes of the illustrative embodiments first obtain the physical address of a suspected router or destination device. Create a data packet that includes at least the destination media access control field, the destination internet protocol field, and the active time field, where the destination media access control field contains the physical address of the destination device and the destination internet protocol field is Contains a bogus internet protocol address and the active time field contains a value indicating that the data packet has exceeded the time limit. Use the physical address in the destination media access control field to send the data packet to the destination device. If an overtime message is received from the destination device, it is determined that the destination device is available for routing.

  The preferred embodiments of the present invention will now be described by way of example only with reference to the following drawings.

1 is a diagrammatic representation of a distributed data processing system in which example embodiments may be implemented. 1 is a block diagram of a data processing system in which example embodiments may be implemented. FIG. 2 illustrates an exemplary software architecture for a data processing system depicted in accordance with a preferred embodiment of the present invention. FIG. 2 illustrates a Transmission Control Protocol / Internet Protocol (TCP / IP) and similar protocols depicted by a preferred embodiment of the present invention. 1 is a block diagram of a rogue router hunter system for discovering unauthorized routers according to exemplary embodiments. FIG. FIG. 6 illustrates a packet created by a rogue router hunter in accordance with exemplary embodiments. 4 is a flow diagram of a process for discovering unauthorized routers in accordance with exemplary embodiments.

  Referring now to the drawings, and more particularly to FIGS. 1-2, an exemplary diagram of a data processing environment is shown in which illustrative embodiments may be implemented. It should be appreciated that FIGS. 1-2 are exemplary only and do not represent or imply any limitation with regard to the environments in which various embodiments may be implemented. Many changes can be made to the depicted environment.

  FIG. 1 depicts a diagrammatic representation of a network of data processing systems in which exemplary embodiments may be implemented. Network data processing system 100 is a network of computers in which the illustrative embodiments can be implemented. The network data processing system 100 includes a network 102, which is a medium used to provide communication links between various devices and computers connected together in the network data processing system 100. Network 102 may include connections such as wires, wireless communication links, or fiber optic cables.

  In the depicted example, server 104 and server 106 are connected to network 102 along with storage device 108. In addition, clients 110, 112, and 114 also connect to network 102. Clients 110, 112, and 114 can be, for example, personal computers or network computers. In the depicted example, server 104 provides data such as boot files, operating system images, and applications to clients 110, 112, and 114. Clients 110, 112, and 114 are clients to server 104 in this example. Network data processing system 100 may include additional servers, clients, and other devices not shown.

  In the depicted example, the network data processing system 100 represents a global set of networks and gateways that use the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol suite to communicate with each other. Internet including. At the heart of the Internet is a backbone of high-speed data communication lines between large nodes or host computers, consisting of thousands of commercial, governmental, educational, and other computer systems that route data and messages. Of course, the network data processing system 100 may also be implemented as several different types of networks, such as, for example, an intranet, a local area network (LAN), or a wide area network (WAN). FIG. 1 is intended as an example, and not as an architectural limitation for different exemplary embodiments.

  Now referring to FIG. 2, a block diagram of a data processing system is shown in which illustrative embodiments may be implemented. Data processing system 200 is an example of a computer, such as server 104 or client 110 in FIG. 1, and in the illustrative embodiments, computer usable program code or instructions implementing the process may be located there. it can. In this illustrative example, data processing system 200 provides communication between processor unit 204, memory 206, persistent storage 208, communication device 210, input / output (I / O) device 212, and display 214. A communication fabric 202 is included.

  The processor unit 204 serves to execute instructions for software that can be loaded into the memory 206. The processor unit 204 may be a set of one or more processors or a multiprocessor core, depending on the particular implementation. Further, the processor unit 204 can be implemented using one or more heterogeneous processor systems in which a main processor is present along with a secondary processor on a single chip. As another illustrative example, processor unit 204 may be a symmetric multiprocessor system including multiple processors of the same type.

  Memory 206 may be, for example, a random access memory in this example. Persistent storage 208 can take a variety of forms depending on the particular implementation. For example, persistent storage 208 can include one or more components or devices. For example, persistent storage 208 can be a hard disk, flash memory, rewritable optical disk, rewritable magnetic tape, or some combination thereof. The media used by persistent storage 208 can also be removable. For example, a removable hard disk can be used for persistent storage 208.

  In these examples, the communication device 210 enables communication with other data processing systems or devices. In these examples, the communication device 210 is a network interface card. The communication device 210 can provide communication by using either or both of a physical link and a wireless communication link.

  The input / output device 212 enables data input / output by other devices that can be connected to the data processing system 200. For example, input / output device 212 may provide a connection for user input via a keyboard and mouse. Further, the input / output device 212 can send output to a printer. Display 214 provides a mechanism for displaying information to the user.

  The instructions for the operating system and application or program are located on persistent storage 208. These instructions can be loaded into memory 206 for execution by processor unit 204. The processes of the various embodiments can be performed by the processor unit 204 using computer-executed instructions that can be located in a memory, such as the memory 206. These instructions are referred to as program code, computer usable program code, or computer readable program code that can be read and executed by a processor in processor unit 204. The program code in various embodiments may be implemented on various physical or tangible computer readable media such as memory 206 or persistent storage 208.

  Program code 216 is located in a functional manner on computer readable medium 218 and may be loaded onto or transferred to data processing system 200 for execution by processor unit 204. Program code 216 and computer readable media 218 form computer program 220 in these examples. In one example, the computer-readable medium 218 is within a drive or other device that is part of the persistent storage device 208 for transfer onto a storage device such as, for example, a hard disk that is part of the persistent storage device 208. It can be in the form of a tangible such as an optical or magnetic disk to be inserted or placed. The tangible form of computer readable media 218 may take the form of persistent storage, such as a hard disk or flash memory, connected to data processing system 200.

  Alternatively, the program code 216 is transferred from the computer readable medium 218 to the data processing system 200 via a communication link to the communication device 210 and / or via a connection to the input / output device 212. can do. The communication link and / or connection may be physical or wireless in the illustrative example. A computer-readable medium may also take the form of a non-tangible medium such as a communication link or wireless transmission that includes program code.

  The various components illustrated for data processing system 200 do not impose architectural limitations on the manner in which various embodiments may be implemented. Various exemplary embodiments may be implemented in a data processing system that includes several components in addition to or in place of those illustrated for data processing system 200. The other components shown in FIG. 2 can be varied from the illustrative example shown.

  For example, a bus system can be used to implement the communication fabric 202, and the bus system can be comprised of one or more buses, such as a system bus or an input / output bus. Of course, the bus system may be implemented using any suitable type of architecture that allows data transfer between various components or devices connected to the bus system. Further, the communication device can include one or more devices used to send and receive data, such as a modem or a network adapter. Further, the memory can be, for example, a memory 206 or cache as detected in an interface and memory controller hub that can reside in the communication fabric 202.

  With reference to FIG. 3, an exemplary embodiment depicts a typical software architecture for a data processing system. This architecture can be implemented in a data processing system such as the data processing system 200 of FIG. At the lowest level of software architecture 300, operating system 302 is used to provide high-level functionality to users and other software. Such operating systems typically include a basic input / output system (BIOS). Communication software 304 directly accesses operating system functions or indirectly bypasses the operating system to access hardware for communication over the network to a network such as the Internet via a physical communication link. Provides communication through external ports.

  Application Program Interface (API) 306 allows system users, individuals, or software routines to invoke system functions using a standard-compliant interface without worrying about how a particular function is implemented. It is what you want to do. Network access software 308 represents any software that can be used to allow the system to access the network. This access can be to a network such as a local area network (LAN), a wide area network (WAN), or the Internet. In the case of the Internet, this software can include a program such as a Web browser. Application software 310 represents any number of software applications that are designed to react to data passing through the communication port to provide the desired functionality that the user is seeking. The mechanisms of the illustrative embodiments can be implemented in the communications software 304 in these examples.

  FIG. 4 is a diagram illustrating a Transmission Control Protocol / Internet Protocol (TCP / IP) and similar protocols depicted by example embodiments. TCP / IP and similar protocols are used by the communication architecture 400. In this example, communication architecture 400 is a four layer system. This architecture includes an application layer 402, a transport layer 404, a network layer 406, and a link layer 408. Each layer is responsible for handling various communication tasks. The link layer 408, also referred to as the data link layer or network interface layer, typically includes a device driver in the operating system and a corresponding network interface in the computer. This layer handles all the hardware details that physically interface with the network media used, such as optical or Ethernet cables.

  Network layer 406, also referred to as the Internet layer, handles the movement of data packets within the network. For example, the network layer 406 handles the routing of various data packets transferred by the network. The network layer 406 in the TCP / IP suite consists of several protocols, including Internet Protocol (IP), Internet Control Message Protocol (ICMP), and Internet Group Management Protocol (IGMP).

  The transport layer 404 then provides an interface between the network layer 406 and the application layer 402 that facilitates the transfer of data between the two host computers. The transport layer 404 can, for example, divide the data passed to it from the application into chunks of an appropriate size for the network layer below it, verify the received packet, and send the transmitted packet to the other side. It relates to setting a timeout for sure confirmation. There are two distinct transport protocols in the TCP / IP protocol suite: TCP and User Datagram Protocol (UDP). TCP includes dropout detection and retransmission services and provides a reliability service to ensure that data is properly transmitted between two hosts.

  Conversely, UDP is much simpler by simply sending data packets called datagrams from one host to another without providing a mechanism to ensure that the data has been properly transferred. Provide services to the application layer. When using UDP, the application layer must perform a reliability function.

  Application layer 402 handles the details of a particular application. For almost all implementations, Telnet for remote login, file transfer protocol (FTP), simple mail transfer protocol (SMTP) for email, simple network management protocol (SNMP: There are many common TCP / IP applications, including simple network management protocol. The mechanisms of the illustrative embodiments can be implemented as a process within the network layer 406.

  The illustrative embodiments provide a rogue router hunter system that detects potential security issues by discovering unauthorized routers in the network. An unauthorized router is a machine that allows the routing function on a machine to be used intentionally or unintentionally without being authorized by the network security administrator. In contrast to existing router discovery methods such as the traceroute utility, the rogue router hunter system of the exemplary embodiments can be used when the IP address of the subnet the machine is routing to is unknown and Enables the network security administrator to determine whether a machine is an unauthorized router if the IP address of the machine on the subnet is unknown. This determination can be made even if a machine on the subnet is not powered on or online at the time of the determination.

  FIG. 5 is a block diagram of a rogue router hunter system for discovering unauthorized routers in accordance with exemplary embodiments. In this example, the unauthorized routing device takes the form of a suspicious subnet router 502. Suspicious subnet router 502 can be a machine with routing capability that is enabled intentionally or unintentionally. Suspicious subnet router (SR) 502 includes a network interface card (NIC) to access Ethernet. The network interface card in the suspected subnet router 502 accesses the Ethernet using a media access control (MAC) address. The MAC address is a hardware address that clearly identifies each node in the network. For example, each network interface card has a different MAC address. The MAC address for the suspicious subnet router 502 is assigned to the network interface card at the manufacturing stage.

  Network 504 is an example of a distributed network that provides communication links between various devices and computers, such as network 102 of FIG. Suspicious subnet router 502 is implemented to route traffic within network 504. Suspicious subnet router 502 can forward data packets on network 504 to subnet 506. In this example, subnet 506 includes multiple machines, such as S1 508 to SN 510.

  Traditional systems use a traceroute utility to determine whether a router is out of order or out of order by sending packets to the router based on the router's known IP address, Router Hunter (RRH) host 512 includes a program that uses a traceroute utility in a unique manner to determine whether a device such as a suspected subnet router 502 is configured as a router. This determination can be made even when the rogue router hunter program does not know the IP address of the suspect router's subnet or the IP address of the machine on the subnet. The rogue router hunter host 512 includes a network interface card having a MAC address for accessing the network 504. Since the rogue router hunter host 512 knows the Ethernet address (MAC address) of the suspicious subnet router 502, it can communicate with the suspicious subnet router 502 via the network 504. The rogue router hunter 512 uses a ping utility to identify whether the target device is on the network, or uses the address resolution protocol when only the target IP address is known, By determining the address, the MAC address of the suspicious subnet router 502 can be obtained. If the packet does not include the subnet router's MAC address in the packet's destination address, the rogue router hunter 512 obtains the MAC address of the suspicious subnet router 502 because the subnet router does not listen or process the packet. There is a need. The ping utility operates by sending an ICMP request packet to the target device and listens for a response. The response packet can include a source MAC address, a destination or target MAC address, a source IP address, and a destination IP address. Thus, the program in the rogue router hunter host 512 has the source MAC address including the MAC address for the rogue router hunter host 512 and the destination MAC address including the MAC address for the suspected subnet router 502. Create a data packet containing. The data packet also includes a fake IP address for the suspected subnet router 502 in the packet's destination ID address field. The rogue router hunter will set the activity time (TTL) value of the packet to 1. The rogue router hunter host 512 then sends the data packet to the suspected subnet router 502 and the destination MAC address in the packet matches the MAC address of the network interface card in the suspected subnet router 502. Therefore, the suspicious subnet router 502 receives the packet.

  The suspicious subnet router 502 examines the packet header to determine if the destination IP address is addressed to the suspicious subnet router 502. If the destination IP address in the packet does not match the IP address of the suspected subnet router 502, the suspected subnet router 502 will discard the packet. Thus, if the subnet router is not configured to route, the subnet router checks the destination IP address, determines that the destination IP address is not the subnet router IP address, and drops the packet. However, if the router function of the suspicious subnet router 502 is enabled, the suspicious subnet router 502 does not discard the packet. In this router availability situation, the suspected subnet router 502 ultimately compares the destination IP address in the packet with the IP address in the routing table to determine the best route for the packet. The subnet router determines that the subnet router must send the packet forward because the destination IP address is not the subnet router's IP address, but the subnet router is configured to route . However, before the suspected subnet router 502 performs this comparison, the suspected subnet router 502 examines the time-to-live (TTL) field. The TTL field is a hop limit used to indicate a limit on the number of iterations that the packet can experience before discarding the packet. If the TTL field is less than or equal to 1, the suspected subnet router 502 returns an overtime (type 11) packet according to the ICMP protocol to the source IP address or rogue router hunter host 512 in the packet. Therefore, the subnet router determines that the packet cannot be routed because the TTL value is too low, and the subnet router notifies the packet sender of this problem. If the rogue router hunter host 512 receives such an ICMP time exceeded message, the rogue router hunter knows that the routing function of the suspected subnet router 502 is enabled. The rogue router hunter host 512 can alert the network security administrator about unauthorized routers.

  In a particular example, a suspicious subnet router 502 using an Advanced Interactive Executive (AIX) operating system receives and inspects packets from the rogue router hunter host 512. If the destination IP address in the packet does not match the IP address of the suspicious subnet router 502 and routing is enabled on the suspicious subnet router 502, the packet is sent to ip_mforward ( ) Is passed to the function. If the TTL in the packet expires (ie, TTL ≦ 1) and the suspected subnet router 502 responds with an ICMP time exceeded (type 11) message, the ip_mforward () function will return 0. If rogue router hunter host 512 receives such an ICMP time exceeded message from suspected subnet router 502, rogue router hunter host 512 can use suspected subnet router 502 for routing. To understand that

  FIG. 6 illustrates a packet created by a rogue router hunter according to exemplary embodiments. A packet 600 can be sent from the rogue router hunter 512 to determine if a machine, such as the suspected subnet router 502 of FIG. Packet 600 includes various fields including source MAC address 602, destination MAC address 604, source IP address 606, destination IP address 608, and TTL field 610.

  The source MAC address 602 is the MAC address of the device that transmits the packet or the rogue router hunter host 512 of FIG.

  The destination MAC address 604 is the MAC address of the device that should receive the packet or the suspected subnet router 502 of FIG. As mentioned above, in situations where the IP address of a suspected routing machine or a machine on a subnet is unknown, a conventional packet containing the source IP address and destination IP address to determine if the suspect machine is routing Can not be used. Using the MAC address of the suspect router that is known to the rogue router hunter, the rogue router hunter creates a packet 600 that allows the rogue router hunter to send the packet to the specific suspect router. • Hunter will address this issue. Thus, when a rogue router hunter sends a packet 600 to a suspect router, the suspect router receives the packet because the destination MAC address in the packet matches the MAC address of the suspect router's network interface card.

  The source IP address 606 is an IP address of a device or rogue router hunter that transmits a packet. The source IP address 606 is used by the suspicious router to return an ICMP time exceeded message to the rogue router hunter when the suspicious router is routing.

  The destination IP address 608 is a fake IP address. Since Rogue Router Hunter does not know the IP address of any suspicious router or subnet machine, the correct destination IP address is not used in packet 600. The fake IP address in destination IP address 608 does not match the IP address of the suspicious router, and therefore the suspicious router attempts to route the packet when routing is enabled, so the suspicious router A fake IP address is placed in the destination IP address 608 to enable the method to process the packet 600 and to allow the rogue router hunter to discover if a suspicious router is routing.

  The TTL field 610 is a value that specifies an activity time value assigned to the packet 600. When Rogue Router Hunter creates packet 600, Rogue Router Hunter assigns a value of “1” to TTL field 610 because only one hop is required between Rogue Router Hunter and the suspect router. . A value of 1 in the TTL field 610 causes the suspicious router to return an ICMP time exceeded message to the rogue router hunter when the suspicious router receives the packet 600.

  FIG. 7 is a flow diagram of a process for discovering unauthorized routers according to exemplary embodiments. This process includes the source MAC address of the rogue router hunter, the destination MAC address of the suspect router, the source IP address of the rogue router hunter, the false destination IP address, and a TTL field having a value of 1. 6 begins when the rogue router hunter program creates a data packet according to the packet 600 of FIG. 6 (step 702). The rogue router hunter sends the packet to the suspect router (step 704). Since the destination MAC address in the packet matches the MAC address of the suspected router's network interface card, the suspected router receives the packet (step 706).

  Next, the suspicious router checks the destination IP address (fake IP address) in the packet to determine whether the packet is for the suspicious router (step 708). Since the destination IP address in the packet is a fake address, the destination IP address in the packet does not match the IP address of the suspicious router. Thus, the suspicious router determines that the packet is not for the suspicious router (step 710).

  At this point, if no routing functionality is enabled on the suspicious router, the suspicious router discards the packet (step 712) and then the process ends. Since the rogue router hunter does not receive an ICMP time exceeded message from the suspect router, the rogue router hunter determines that the suspect router is not routing.

  However, if the routing function is enabled on the suspicious router, the suspicious router checks the TTL field in the packet (step 714). Since the TTL field in the packet created by the rogue router hunter has a value of 1, the suspicious router will send an ICMP time exceeded message to the rogue router hunter (packet sender) based on the source IP address in the packet. Is returned (step 716). Since the source IP address in the packet is the rogue router hunter's IP address, the rogue router hunter receives an ICMP time exceeded message (step 718).

  When the overtime message from the suspicious router is received by the rogue router hunter, the rogue router hunter knows that the suspicious router is routing (step 720). The rogue router hunter can then alert the network security administrator that the suspect router is an unauthorized router on the network (step 722), after which the process ends.

  Embodiments of the invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, including but not limited to firmware, resident software, microcode, etc.

  Further, embodiments of the invention are in the form of a computer program accessible from a computer-usable or computer-readable medium that provides program code for use by or in connection with a computer or any instruction execution system. Can take. For purposes of this description, a computer-usable or computer-readable medium is any medium that can contain, store, communicate, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. It can be a tangible device.

  The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of computer readable media include semiconductor or solid state memory, magnetic tape, removable computer diskette, random access memory (RAM), read only memory (ROM), rigid magnetic disk, and optical disk. Current examples of optical disks include compact disk read-only memory (CD-ROM), rewritable compact disk (CD-R / W), and DVD.

  Further, the computer storage medium is computer readable such that when the computer readable program code is executed on the computer, execution of the computer readable program code causes the computer to transmit other computer readable program code over a communication link. Can contain or store program code. This communication link may use, for example, without limitation, a medium that is physical or wireless.

  A data processing system suitable for storing and / or executing program code will include at least one processor coupled directly or indirectly to storage elements through a system bus. The storage elements include local memory used during actual execution of program code, mass storage, and at least to reduce the number of times code must be retrieved from mass storage during execution. And cache memory that provides temporary storage of some program code.

  Input / output or I / O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening input / output controllers.

  Network adapters can also be coupled to the system so that the data processing system can be coupled to other data processing systems or remote printers or storage devices via private or public networks . Modems, cable modems, and Ethernet cards are just some of the currently available types of network adapters.

  The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to practitioners skilled in this art. This embodiment is intended to best illustrate the principles of the invention, practical applications, and to illustrate the invention with respect to various embodiments including various modifications suitable for the particular application contemplated by those skilled in the art. It has been chosen and described for the sake of understanding.

Claims (20)

A computer-implemented method for detecting unauthorized routers in a distributed network comprising:
Obtaining the physical address of the destination device;
Creating a data packet including at least a destination media access control field, a destination internet protocol field, and an active time field, wherein the destination media access control field includes the physical address of the destination device; The destination internet protocol field includes a fake internet protocol address and the activity time field includes a value indicating that the data packet has exceeded a time limit;
Transmitting the data packet to the destination device using the physical address in the destination media access control field;
In response to receiving an overtime message from the destination device, determining that the destination device is available for routing;
A computer-implemented method comprising: 2. The computer-implemented method of claim 1, further comprising determining that the destination device is not available for routing in response to not receiving an overtime message from the destination device. Method.   The computer-implemented method of claim 1, wherein the physical address of the destination device is a media access control address of a network interface card in the destination device.   The said data packet further comprises a source media access control field comprising a physical address of the source device and a source internet protocol field comprising an internet protocol address of said source device. A method performed by a computer.   Whether the destination device examines the destination internet protocol address in the data packet and whether the destination internet protocol address in the data packet matches the internet protocol address of the destination device And if the routing is enabled on the destination device, check the value of the activity time field in the data packet to determine that the data packet has exceeded a time limit. The computer-implemented method of claim 1, wherein the time exceeded message is sent to the internet protocol address in the source internet protocol address field when the value indicates.   6. The computer-implemented method of claim 5, wherein the destination device discards the data packet when routing is not enabled on the destination device.   The computer-implemented method of claim 1, wherein the determination is made that the destination device is enabled for routing when the internet protocol address for the destination device is unknown. Method.   2. The determination is performed that the destination device is enabled for routing when the internet protocol address for a device on the destination device subnet is unknown. A method performed by a computer.   The computer-implemented method of claim 8, wherein the device is offline or powered off.   The computer-implemented method of claim 1, wherein the physical address of the destination device is obtained using one of a ping utility or an address resolution protocol. A data processing system for detecting unauthorized routers in a distributed network,
With bus,
A storage device connected to the bus, the storage device including computer usable code;
At least one management device connected to the bus;
A communication device connected to the bus;
A processing device connected to the bus, obtaining a physical address of the destination device, creating a data packet including at least a destination media access control field, a destination internet protocol field, and an active time field; The destination media access control field contains the physical address of the destination device, the destination internet protocol field contains a fake internet protocol address, and the activity time field indicates that the data packet has exceeded the time limit In response to receiving the time exceeded message from the destination device and transmitting the data packet to the destination device using the physical address in the destination media access control field. The destination device A processor for executing the computer usable code to determine that become available for designation,
Including data processing system. A computer program for detecting unauthorized routers in a distributed network,
Including a computer usable medium in which the computer usable program code is tangibly implemented, the computer usable program code comprising:
Computer usable program code to obtain the physical address of the destination device;
Computer-usable program code for creating a data packet including at least a destination media access control field, a destination internet protocol field, and an active time field, wherein the destination media access control field is the destination device A computer-usable program comprising: a physical internet address; wherein the destination internet protocol field comprises a fake internet protocol address; and the activity time field comprises a value indicating that the data packet has exceeded a time limit. Code,
Computer usable program code for transmitting the data packet to the destination device using the physical address in the destination media access control field;
Computer-usable program code for determining that the destination device is enabled for routing in response to receiving an overtime message from the destination device;
Including computer programs. The computer-usable program code for determining that the destination device is not enabled for routing in response to not receiving an overtime message from the destination device. 12. The computer program according to 12.   The computer program product according to claim 12, wherein the physical address of the destination device is a media access control address of a network interface card in the destination device.   The said data packet further includes a source media access control field that includes a physical address of the source device and a source internet protocol field that includes an internet protocol address of the source device. Computer program.   Whether the destination device examines the destination internet protocol address in the data packet and whether the destination internet protocol address in the data packet matches the internet protocol address of the destination device And if the routing is enabled on the destination device, check the value of the activity time field in the data packet to determine that the data packet has exceeded a time limit. 13. The computer program product of claim 12, wherein when the value indicates, the overtime message is sent to the internet protocol address in the source internet protocol address field.   The computer program product of claim 16, wherein the destination device discards the data packet when routing is not enabled on the destination device.   Used by the destination device for routing when the Internet protocol address for the destination device is unknown or when the Internet protocol address for a device on the destination device's subnet is unknown The computer program product of claim 12, wherein the determination is made that it is possible.   The computer program product of claim 18, wherein the device is offline or powered off.   The computer program product of claim 12, wherein the physical address of the destination device is obtained using one of a ping utility or an address resolution protocol.

Images